False positive: Rule 600005 (macOS kernel panic) matches benign Docker Desktop QEMU parameter `panic=0`

### Summary

A level‑12 alert (`600005 – macOS: Critical kernel panic or fatal error detected`) is incorrectly triggered on a **Linux** agent when Docker Desktop launches its internal QEMU virtual machine. The alert is caused by the safe kernel boot parameter `panic=0`, which appears in the QEMU command line.

### Environment

- **Agent OS:** Linux (hostname: `said-ws`, ID: `037`)
- **Agent software:** Docker Desktop with internal QEMU/linuxkit VM
- **Log source:** `/var/log/syslog`
- **Wazuh manager:** 4.x

### Example alert (full_log)
```
2026-07-28T07:41:37.149202+01:00 said-ws com.docker.backend[688774]: ... -append init=/initd ... panic=0 ... console=ttyS0 ...
```

The keyword `panic=0` is part of the QEMU `-append` kernel arguments – it tells the Linux kernel to halt on panic, not reboot. No actual panic or kernel fault has occurred.

### Alert produced

- **Rule ID:** 600005
- **Level:** 12
- **Description:** `macOS: Critical kernel panic or fatal error detected`
- **Groups:** `macos, syslog, kernel, system_error`
- **Compliance:** PCI DSS, GDPR, HIPAA, etc. (inherited)

### Root cause

The rule’s PCRE2 regex `(?:panic|kernel\s+trap|fatal(?:\s+error)?|critical(?:\s+error)?)` matches the substring `panic` anywhere in the log. It does not exclude the safe kernel parameter `panic=0`, and it applies to all agents regardless of operating system.

### Expected behaviour

- `panic=0` in a kernel command line should **never** trigger a kernel panic alert.
- Docker Desktop’s QEMU start‑up messages should be excluded, or the rule should be restricted to macOS agents.